In December 2025, a wave of notifications swept across the screens of hundreds of iPhone and Android users, alerting them that their devices had been targeted by spyware. This came shortly after Apple and Google patched several vulnerabilities believed to have been exploited to introduce stealthy malware into specific devices.
Spyware is particularly insidious because it allows attackers to monitor users’ activities on their smartphones, including communications through encrypted messaging platforms like WhatsApp and Signal. Although such targeted attacks are often aimed at high-profile individuals – dissidents, journalists, politicians, and influential business figures – the reach of spyware is expanding and increasingly affecting individuals in various sectors.
Notably, public figures like former Amazon CEO Jeff Bezos and the wife of slain journalist Jamal Khashoggi were compromised by NSO Group’s notorious Pegasus spyware. The recurrence of such intrusions was further evidenced by Google researchers detailing their findings about Predator spyware, which was covertly installed on devices using a chain of exploits.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued warnings that malicious actors are actively exploiting commercial spyware to infiltrate mobile messaging applications. The predicted shift in threat scale indicates that ordinary users might be more at risk than before.
Spyware infection methods can be particularly alarming. Often termed “zero-click” attacks, they allow hackers to breach devices without any user interaction like clicking links or downloading files. Once infiltrated, spyware can capture sensitive information such as messages, keystrokes, and banking details. Additionally, common methods of infection include clicking on malicious links or downloading seemingly legitimate applications that are in fact harmful.
Over recent years, the proliferation of spyware has been met with alarming reactions from human rights advocates, highlighting the misuse of these tools against activists and journalists worldwide. Such technology, initially claimed to be solely for targeting criminals, has proven to be a mechanism of oppression against those marginalized or dissenting voices, as seen in cases like Thai activist Niraphorn Onnkhaow, who faced multiple spyware attacks during pro-democracy protests.
Detecting spyware can be challenging, especially sophisticated types like Pegasus or Predator that often require detailed forensic analysis to uncover. However, signs such as device overheating, slow performance, or unexpected activation of cameras and microphones could indicate a compromise.
When it comes to prevention, both Apple and Google have introduced robust security features. Apple’s Lockdown Mode is designed for users at risk, providing heightened security at the expense of certain functionalities. Users are encouraged to turn on Lockdown Mode by navigating through Settings > Privacy & Security > Lockdown Mode. Similarly, Google offers Advanced Protection for Android users, which includes options for securing USB connections and disabling auto-reconnections to insecure networks.
Beyond utilizing these protective measures, users must maintain vigilance about installing apps and should be wary of unsolicited links and requests, especially from unknown sources. Regularly updating mobile operating systems and apps is essential, as these updates often patch vulnerabilities commonly exploited by spyware.
If you suspect your device has been compromised, simply restarting it may provide a temporary respite from spyware, but in serious cases, replacing the device may be the most prudent action. Support organizations like Amnesty International, Access Now, and Reporters Without Borders are available to help individuals concerned about spyware targeting.
Overall, maintaining a skeptical approach toward digital interactions while striving for safe practices can significantly reduce the risk of becoming a victim of spyware.
